Cloudflare/rulesets

@webframp/cloudflare/rulesetsv2026.11.05.2· Apache-2.0· 1d agoBEHAVIORS

01README

Cloudflare Rulesets — WAF custom rules, transform rules, managed rulesets

02Release Notes

2026.11.05.2

Fixed: The four ruleset/rule CREATE methods now write the created entity again: createaccountruleset, createaccountrulesetrule, createzoneruleset, and createzonerulesetrule. The previous version wrongly treated them as no-content writes and returned { dataHandles: [] }, silently dropping the created ruleset/rule ID. Cloudflare POST creates return HTTP 200 with the created entity in result; a create always persists it, naming the instance by the response id (else a scoping path param, else a request hash). The update methods (updateaccountentrypointruleset, updateaccountruleset, updateaccountrulesetrule, updatezoneentrypointruleset, updatezoneruleset, updatezonerulesetrule) genuinely return no body and correctly remain no-write.

Upgrade note: The four create resources are declared again. If you ran the previous version, re-run the create to capture the created entity; no stored data needs migration.

2026.11.05.1

Fixed: The ruleset and rule create/update methods are writes whose success response carries no body (HTTP 204). Earlier versions declared a resource with an empty schema for each and wrote an empty {} (or a dead instance name) on every call. Each method now issues the API call for its side effect and returns no data handles — it stores nothing. Their empty resource specs are gone. Affected: createaccountruleset, updateaccountentrypointruleset, updateaccountruleset, createaccountrulesetrule, updateaccountrulesetrule, createzoneruleset, updatezoneentrypointruleset, updatezoneruleset, createzonerulesetrule and updatezonerulesetrule.

Upgrade note: The matching resources are no longer declared. Any data earlier versions wrote under them is stale; delete it with swamp data delete.

2026.11.03.1

Changed: Bump zod 4.6.5 → 4.6.7

2026.10.21.1

Changed: The README and the apiToken description now lead with a vault. Store the token with swamp vault put cloudflare API_TOKEN and set apiToken to ${{ vault.get("cloudflare", "API_TOKEN") }}. The CLOUDFLARE_API_TOKEN environment variable still works as a fallback, but swamp does not redact it, so it is no longer recommended. The missing-token error now says the same.

Fixed: Create methods whose response carries no id wrote every result to one instance named created, so each call overwrote the previous one. They now name the instance by the response's id when present, else by the path parameter that scopes the call, else by a hash of the request arguments (secret arguments left out). Affected: createaccountruleset, createaccountrulesetrule, createzoneruleset and createzonerulesetrule.

Upgrade note: Results earlier versions wrote to the created instance stay there; new runs write under the new names.

03Behaviors1

@webframp/cloudflare/rulesetsv2026.11.05.2cloudflare/rulesets.ts

Global Arguments

Argument	Type	Required	Description
apiToken?	string	no	Cloudflare API token. Wire it with ${{ vault.get("cloudflare", "API_TOKEN") }}; never pass the literal token. The CLOUDFLARE_API_TOKEN environment variable is read as a fallback, but it is not redacted and is not recommended.
accountId	string	yes	Cloudflare account ID

fn listaccountrulesets(cursor?: string, per_page?: string)

List account rulesets

Argument	Type	Required	Description
cursor?	string	no
per_page?	string	no

fn createaccountruleset(description?: string, last_updated: string, name: string, version: unknown, kind: unknown, phase: unknown, rules?: unknown)

Create an account ruleset

Argument	Type	Required	Description
description?	string	no	An informative description of the ruleset.
last_updated	string	yes	The timestamp of when the ruleset was last modified.
name	string	yes	The human-readable name of the ruleset.
version	unknown	yes
kind	unknown	yes
phase	unknown	yes
rules?	unknown	no

fn getaccountentrypointruleset(ruleset_phase: string)

Get an account entry point ruleset

Argument	Type	Required	Description
ruleset_phase	string	yes

fn updateaccountentrypointruleset(ruleset_phase: string, description?: string, last_updated: string, name?: string, version: unknown, rules?: unknown)

Update an account entry point ruleset

Argument	Type	Required	Description
ruleset_phase	string	yes
description?	string	no	An informative description of the ruleset.
last_updated	string	yes	The timestamp of when the ruleset was last modified.
name?	string	no	The human-readable name of the ruleset.
version	unknown	yes
rules?	unknown	no

fn listaccountentrypointrulesetversions(ruleset_phase: string)

List an account entry point ruleset's versions

Argument	Type	Required	Description
ruleset_phase	string	yes

fn getaccountentrypointrulesetversion(ruleset_version: string, ruleset_phase: string)

Get an account entry point ruleset version

Argument	Type	Required	Description
ruleset_version	string	yes
ruleset_phase	string	yes

fn getaccountruleset(ruleset_id: string)

Get an account ruleset

Argument	Type	Required	Description
ruleset_id	string	yes

fn updateaccountruleset(ruleset_id: string, description?: string, last_updated: string, name?: string, version: unknown, kind?: unknown, phase?: unknown, rules?: unknown)

Update an account ruleset

Argument	Type	Required	Description
ruleset_id	string	yes
description?	string	no	An informative description of the ruleset.
last_updated	string	yes	The timestamp of when the ruleset was last modified.
name?	string	no	The human-readable name of the ruleset.
version	unknown	yes
kind?	unknown	no
phase?	unknown	no
rules?	unknown	no

fn deleteaccountruleset(ruleset_id: string)

Delete an account ruleset

Argument	Type	Required	Description
ruleset_id	string	yes

fn createaccountrulesetrule(ruleset_id: string, position?: union)

Create an account ruleset rule

Argument	Type	Required	Description
ruleset_id	string	yes
position?	union	no

fn updateaccountrulesetrule(rule_id: string, ruleset_id: string, position?: union)

Update an account ruleset rule

Argument	Type	Required
rule_id	string	yes
ruleset_id	string	yes
position?	union	no

fn deleteaccountrulesetrule(rule_id: string, ruleset_id: string)

Delete an account ruleset rule

Argument	Type	Required	Description
rule_id	string	yes
ruleset_id	string	yes

fn listaccountrulesetversions(ruleset_id: string)

List an account ruleset's versions

Argument	Type	Required	Description
ruleset_id	string	yes

fn getaccountrulesetversion(ruleset_version: string, ruleset_id: string)

Get an account ruleset version

Argument	Type	Required	Description
ruleset_version	string	yes
ruleset_id	string	yes

fn deleteaccountrulesetversion(ruleset_version: string, ruleset_id: string)

Delete an account ruleset version

Argument	Type	Required	Description
ruleset_version	string	yes
ruleset_id	string	yes

fn listaccountrulesetversionrulesbytag(rule_tag: string, ruleset_version: string, ruleset_id: string)

List an account ruleset version's rules by tag

Argument	Type	Required
rule_tag	string	yes
ruleset_version	string	yes
ruleset_id	string	yes

fn listzonerulesets(zone_id: string, cursor?: string, per_page?: string)

List zone rulesets

Argument	Type	Required
zone_id	string	yes
cursor?	string	no
per_page?	string	no

fn createzoneruleset(zone_id: string, description?: string, last_updated: string, name: string, version: unknown, kind: unknown, phase: unknown, rules?: unknown)

Create a zone ruleset

Argument	Type	Required	Description
zone_id	string	yes
description?	string	no	An informative description of the ruleset.
last_updated	string	yes	The timestamp of when the ruleset was last modified.
name	string	yes	The human-readable name of the ruleset.
version	unknown	yes
kind	unknown	yes
phase	unknown	yes
rules?	unknown	no

fn getzoneentrypointruleset(ruleset_phase: string, zone_id: string)

Get a zone entry point ruleset

Argument	Type	Required	Description
ruleset_phase	string	yes
zone_id	string	yes

fn updatezoneentrypointruleset(ruleset_phase: string, zone_id: string, description?: string, last_updated: string, name?: string, version: unknown, rules?: unknown)

Update a zone entry point ruleset

Argument	Type	Required	Description
ruleset_phase	string	yes
zone_id	string	yes
description?	string	no	An informative description of the ruleset.
last_updated	string	yes	The timestamp of when the ruleset was last modified.
name?	string	no	The human-readable name of the ruleset.
version	unknown	yes
rules?	unknown	no

fn listzoneentrypointrulesetversions(ruleset_phase: string, zone_id: string)

List a zone entry point ruleset's versions

Argument	Type	Required	Description
ruleset_phase	string	yes
zone_id	string	yes

fn getzoneentrypointrulesetversion(ruleset_version: string, ruleset_phase: string, zone_id: string)

Get a zone entry point ruleset version

Argument	Type	Required
ruleset_version	string	yes
ruleset_phase	string	yes
zone_id	string	yes

fn getzoneruleset(ruleset_id: string, zone_id: string)

Get a zone ruleset

Argument	Type	Required	Description
ruleset_id	string	yes
zone_id	string	yes

fn updatezoneruleset(ruleset_id: string, zone_id: string, description?: string, last_updated: string, name?: string, version: unknown, kind?: unknown, phase?: unknown, rules?: unknown)

Update a zone ruleset

Argument	Type	Required	Description
ruleset_id	string	yes
zone_id	string	yes
description?	string	no	An informative description of the ruleset.
last_updated	string	yes	The timestamp of when the ruleset was last modified.
name?	string	no	The human-readable name of the ruleset.
version	unknown	yes
kind?	unknown	no
phase?	unknown	no
rules?	unknown	no

fn deletezoneruleset(ruleset_id: string, zone_id: string)

Delete a zone ruleset

Argument	Type	Required	Description
ruleset_id	string	yes
zone_id	string	yes

fn createzonerulesetrule(ruleset_id: string, zone_id: string, position?: union)

Create a zone ruleset rule

Argument	Type	Required
ruleset_id	string	yes
zone_id	string	yes
position?	union	no

fn updatezonerulesetrule(rule_id: string, ruleset_id: string, zone_id: string, position?: union)

Update a zone ruleset rule

Argument	Type	Required
rule_id	string	yes
ruleset_id	string	yes
zone_id	string	yes
position?	union	no

fn deletezonerulesetrule(rule_id: string, ruleset_id: string, zone_id: string)

Delete a zone ruleset rule

Argument	Type	Required
rule_id	string	yes
ruleset_id	string	yes
zone_id	string	yes

fn listzonerulesetversions(ruleset_id: string, zone_id: string)

List a zone ruleset's versions

Argument	Type	Required	Description
ruleset_id	string	yes
zone_id	string	yes

fn getzonerulesetversion(ruleset_version: string, ruleset_id: string, zone_id: string)

Get a zone ruleset version

Argument	Type	Required
ruleset_version	string	yes
ruleset_id	string	yes
zone_id	string	yes

fn deletezonerulesetversion(ruleset_version: string, ruleset_id: string, zone_id: string)

Delete a zone ruleset version

Argument	Type	Required
ruleset_version	string	yes
ruleset_id	string	yes
zone_id	string	yes

fn listzonerulesetversionrulesbytag(rule_tag: string, ruleset_version: string, ruleset_id: string, zone_id: string)

List a zone ruleset version's rules by tag

Argument	Type	Required
rule_tag	string	yes
ruleset_version	string	yes
ruleset_id	string	yes
zone_id	string	yes

Resources

listaccountrulesets(infinite)— List account rulesets

createaccountruleset(infinite)— Create an account ruleset

getaccountentrypointruleset(infinite)— Get an account entry point ruleset

listaccountentrypointrulesetversions(infinite)— List an account entry point ruleset's versions

getaccountentrypointrulesetversion(infinite)— Get an account entry point ruleset version

getaccountruleset(infinite)— Get an account ruleset

createaccountrulesetrule(infinite)— Create an account ruleset rule

listaccountrulesetversions(infinite)— List an account ruleset's versions

getaccountrulesetversion(infinite)— Get an account ruleset version

listaccountrulesetversionrulesbytag(infinite)— List an account ruleset version's rules by tag

listzonerulesets(infinite)— List zone rulesets

createzoneruleset(infinite)— Create a zone ruleset

getzoneentrypointruleset(infinite)— Get a zone entry point ruleset

listzoneentrypointrulesetversions(infinite)— List a zone entry point ruleset's versions

getzoneentrypointrulesetversion(infinite)— Get a zone entry point ruleset version

getzoneruleset(infinite)— Get a zone ruleset

createzonerulesetrule(infinite)— Create a zone ruleset rule

listzonerulesetversions(infinite)— List a zone ruleset's versions

getzonerulesetversion(infinite)— Get a zone ruleset version

listzonerulesetversionrulesbytag(infinite)— List a zone ruleset version's rules by tag

04Previous Versions14

2026.11.03.1Apache-2.0Nov 4, 2026

2026.11.03.1

Changed: Bump zod 4.6.5 → 4.6.7

2026.10.21.1

Upgrade note: Results earlier versions wrote to the created instance stay there; new runs write under the new names.

2026.10.21.1Apache-2.0Oct 21, 2026

2026.10.21.1

Upgrade note: Results earlier versions wrote to the created instance stay there; new runs write under the new names.

2026.10.14.1Apache-2.0(was none)Oct 14, 2026

2026.10.14.1

Fixed: Methods that write a singleton resource failed on current swamp with Data name 'latest' is reserved for internal use.

Changed: Singleton get and action methods now write their data under listaccountrulesets-current instead of latest. Anything that read data.latest("<model>", "latest") or queried name == "latest" must use the new name.

Upgrade note: Data previously stored under latest is not migrated; re-run the method to populate the new name. No attribute schemas changed.

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

2026.09.18.1Sep 20, 2026

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.09.17.2Sep 17, 2026

2026.09.17.2

No changes to this extension's methods. Regenerated to refresh the shared _lib/api.ts helper library after PR #427 review fixes to cfApiPaginatedCursor (used by r2, kv, durable-objects, and workers-ai, but emitted into every extension's api.ts since it's part of the shared template).

2026.09.15.1Sep 15, 2026

2026.09.15.1

Changed: Bump zod 4.4.3 → 4.6.5

2026.08.28.2

Hardened codegen: instance names sanitized against path traversal; 429 rate-limit retry with Retry-After; string schema patterns emit regex validation; output schemas passthrough unknown fields; apiToken now optional and vault-wireable with CLOUDFLARE_API_TOKEN env fallback.

2026.08.28.2Aug 28, 2026

2026.08.28.2

2026.08.28.1Aug 28, 2026

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.2Aug 27, 2026

2026.08.26.2

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.24.1Aug 24, 2026

2026.08.24.1

Added: Output metadata attributes for observability.

durationMs: Method execution duration in milliseconds.
collectedBy: Extension name that produced the data.
fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).

2026.08.21.2Aug 22, 2026

2026.08.21.2

Changed:

Errors raised when a Cloudflare API call fails now name the HTTP method and path that was attempted (e.g. Cloudflare API GET /accounts/.../rulesets/xxx failed with HTTP 400 ...) instead of a bare Cloudflare API error: .... Network-level failures (DNS, connection reset, timeout) are now also caught and wrapped with the same operation context instead of surfacing a raw fetch error.

No breaking changes.

2026.08.21.1Aug 21, 2026

2026.08.21.1

Changed: Added .describe() and .min(1) to the identifier arguments used across most methods — zone_id, ruleset_id, ruleset_version, ruleset_phase, rule_id, and rule_tag — plus .describe() on the cursor/per_page pagination arguments. No behavioral changes.

2026.07.27.1

Fixed: Regenerated from scripts/cloudflare-codegen after two generator bugs were repaired (webframp/swamp-extensions#284).

Methods referencing an undeclared path parameter did not compile. The generator derived a method's arguments schema and execute signature from the OpenAPI parameters list, but built the request URL from the path template. Where the Cloudflare spec omits a declaration for a {placeholder} — which it does in several places — the result was a method with arguments: z.object({}) and an unused _args parameter whose body still interpolated args.<name>. Those methods failed type checking and were uncallable even if they had compiled, because the argument was never declared. Path-template placeholders are now unioned into the declared parameters, so the schema, the signature, and the body agree.
Generated tests could request a URL the mock server did not serve. Test arguments merged the request-body fixture over the path-parameter values, so a body property sharing a name with a path parameter (commonly id) substituted its own example value into the URL. The request then missed the mock and failed with Cloudflare API error: Not found. Path parameters now take precedence, matching what the generated model already does by excluding path-parameter names from the request body.

Upgrade note: No API surface change and no method was added or removed. If this extension type-checked and tested cleanly before, its behavior is unchanged and only the version moved. Extensions that previously failed deno check or deno task test now pass.

2026.07.27.1Jul 27, 2026

2026.07.27.1

Fixed: Regenerated from scripts/cloudflare-codegen after two generator bugs were repaired (webframp/swamp-extensions#284).

Methods referencing an undeclared path parameter did not compile. The generator derived a method's arguments schema and execute signature from the OpenAPI parameters list, but built the request URL from the path template. Where the Cloudflare spec omits a declaration for a {placeholder} — which it does in several places — the result was a method with arguments: z.object({}) and an unused _args parameter whose body still interpolated args.<name>. Those methods failed type checking and were uncallable even if they had compiled, because the argument was never declared. Path-template placeholders are now unioned into the declared parameters, so the schema, the signature, and the body agree.
Generated tests could request a URL the mock server did not serve. Test arguments merged the request-body fixture over the path-parameter values, so a body property sharing a name with a path parameter (commonly id) substituted its own example value into the URL. The request then missed the mock and failed with Cloudflare API error: Not found. Path parameters now take precedence, matching what the generated model already does by excluding path-parameter names from the request body.